Romanian Waters (Administrația Națională Apele Române) hit by ransomware attack
Incident
Summary
Hide ▲
Show ▼
Romanian Waters (Administrația Națională Apele Române) was hit by a ransomware attack that disrupted about 1,000 systems across 10 of 11 regional offices, while OT water controls stayed unaffected. Attackers reportedly used Windows BitLocker to lock files and left a ransom note demanding contact within 7 days. Romanian agencies are investigating and working to contain the impact. The incident affected core IT services including GIS, databases, email, web services, and domain name servers.
Related Happenings
Gentlemen ransomware affiliate campaign expanding toolkit and infrastructure
Campaign
First: 20.04.2026 23:02
Last: 20.04.2026 23:02
Sources 1
About this happening:
The **Gentlemen ransomware** campaign has now been tied to a **ransomware attack on Oltenia Energy Complex** on the **second day of Christmas**, disrupting **ERP systems**, **docu...
Gentlemen ransomware affiliate campaign expanding toolkit and infrastructure
CampaignAbout this happening: The **Gentlemen ransomware** campaign has now been tied to a **ransomware attack on Oltenia Energy Complex** on the **second day of Christmas**, disrupting **ERP systems**, **docu...
Aleksey Olegovich Volkov sentenced in Yanluowang ransomware case
Law Enforcement
First: 24.03.2026 15:06
Last: 24.03.2026 15:06
Sources 1
About this happening:
The **Justice Department** said **Aleksey Olegovich Volkov** was **sentenced to 81 months** in prison for serving as an **initial access broker** in **Yanluowang ransomware** atta...
Aleksey Olegovich Volkov sentenced in Yanluowang ransomware case
Law EnforcementAbout this happening: The **Justice Department** said **Aleksey Olegovich Volkov** was **sentenced to 81 months** in prison for serving as an **initial access broker** in **Yanluowang ransomware** atta...
INC ransomware healthcare targeting campaign across Oceania
Campaign
First: 12.03.2026 00:00
Last: 12.03.2026 00:00
Sources 1
About this happening:
The **INC ransomware operation** has expanded its targeting of **healthcare organizations** across **Oceania**, increasing the risk of **service disruption** and **data theft**. T...
INC ransomware healthcare targeting campaign across Oceania
CampaignAbout this happening: The **INC ransomware operation** has expanded its targeting of **healthcare organizations** across **Oceania**, increasing the risk of **service disruption** and **data theft**. T...
Oltenia Energy Complex (Complexul Energetic Oltenia) hit by ransomware attack
Incident
First: 29.12.2025 16:26
Last: 29.12.2025 16:26
Sources 1
About this happening:
A **ransomware attack** hit **Oltenia Energy Complex** and encrypted files while taking key business systems offline, disrupting operations during the holiday period. **ERP**, **d...
Oltenia Energy Complex (Complexul Energetic Oltenia) hit by ransomware attack
IncidentAbout this happening: A **ransomware attack** hit **Oltenia Energy Complex** and encrypted files while taking key business systems offline, disrupting operations during the holiday period. **ERP**, **d...
Nefilim ransomware extortion campaign targeting high-revenue businesses
Campaign
First: 22.12.2025 11:46
Last: 22.12.2025 11:46
Sources 1
About this happening:
A **Nefilim** ransomware campaign now includes the **U.S. Department of Justice** charging **Volodymyr Viktorovich Tymoshchuk** for allegedly serving as an administrator of the op...
Nefilim ransomware extortion campaign targeting high-revenue businesses
CampaignAbout this happening: A **Nefilim** ransomware campaign now includes the **U.S. Department of Justice** charging **Volodymyr Viktorovich Tymoshchuk** for allegedly serving as an administrator of the op...
Timeline
-
22.12.2025 17:25 2 articles · 5mo ago
Romanian Waters ransomware attack disclosed
Initial DisclosureRomanian Waters (Administrația Națională Apele Române) was hit by a ransomware attack over the weekend, disrupting approximately 1,000 computer systems across 10 of its 11 regional offices while OT systems controlling water infrastructure remained unaffected. Romanian security agencies, including the Romanian Intelligence Service's National Cyberint Center, were investigating and working to contain the impact after finding that attackers used Windows BitLocker to lock files and left a ransom note demanding contact within 7 days; the attack vector had not yet been identified.
Show sources
- Romanian water authority hit by ransomware attack over weekend — www.bleepingcomputer.com — 22.12.2025 17:25
- Romanian water authority hit by ransomware attack over weekend — www.bleepingcomputer.com — 22.12.2025 17:25